Forums

Rooting

Rooting

Submitted by sargun on Wed, 2013-01-02 23:37

So, who here is interesting in root (linux) on the car? I haven't plugged in anything interesting into the USB ports to see how they respond, but that's probably our easier attack vector. My plan is to get a USB to Ethernet convertor, and see if the car asks for a DHCP lease. Assuming it does, we can start to MITM the car, and such.

Has anyone plugged a USB keyboard into the car to see what happens?

Has anyone figured out the access code required to get into diagnostic mode?

Alternatively, I'm assuming that the Model S's computer is probably some sort of ARM, or x86 embedded device. If we turn it off, and put a bootable USB stick in, and turn it back on, we should get it to boot from USB, assuming that it's in the boot order.

Anyways, that seems like it might be a fun weekend project, once I get my at-home charger installed.

DigitalSavant |
2 January, 2013

LOL! Be careful.. don't brick your car on the first day! :)

It's funny.. a friend just asked me today if it was possible to plug in a usb keyboard to type with instead of the touch screen. Sounded interesting, but I haven't tried it yet.

sergiyz |
3 January, 2013

I really hope the drivetrain controller is completely separate from the 17" screen and is not exposed on the Internet or via local unauthenticated connections.
I also hope they sign all the updates and verify both certificates and checksums, and tunnel all service connections via VPN protected by dual-factor auth, ideally a reverse tunnel too...
I know Tesla has a remote shell of some sort on the box, hopefully implemented properly (see above).

sargun |
3 January, 2013

So, I just plugged in my Apple USB keyboard, it responds. Additionally, I plugged in my USB mouse, and it responds as well. Although the USB keyboard was wonky, I was able to get it to ctrl+alt+f1, switching to a different tty. I wasn't able to get a console, so I'm wondering whether the software doesn't run a console on tty0, or if it's the screen. Either way, I was then able to ctrl+alt+del, and get the entire system to reboot.

I'm probably going to see if I can get the usb->ethernet converters at work tomorrow.

Does anyone know the FCC ID of the Model S in order to find the CPU being used?

sargun |
3 January, 2013

sergiyz -- I am pretty sure the drivetrain controller is separated from the dashboard auth. Probably connected over serial, or similar.

sargun |
3 January, 2013

The FCC ID of the remote unlock is AQO002. I wonder if they had to get a separate FCC equipment authorization for the entire car.

bredell |
3 January, 2013

A Tesla employee mentioned in one of the videos that there are two separate main computers, each controlling a separate screen, and they are connected through ethernet. The same guy also said that the system was not running Linux. If any of this is true no one knows. Yet.

From a licensing perspective it could make more sense to run some version of BSD.

I have always expected the car to run two separate systems, one isolated and heavily protected system that controls the actual engine and also controls the dashboard, and another system that controls the touch screen which will be able to run third party apps.

Volker.Berlin |
3 January, 2013

I definitely plan on using a keyboard in my Model S, but I'd prefer Bluetooth over USB for obvious reasons. Can someone try to connect a Bluetooth keyboard? I'm not planning on hacking the system that way, just looking for a convenient way to use web email (and these forums, of course).

sargun |
3 January, 2013

@bredell They are running Linux. Look at the user agent of the browser, and it identifies as QtWebKit running on Linux.

I doubt they would spoof as Linux if they were running BSD. If Tesla Motors developed their own operating system for the Model S, that would surprise me.

BigTex |
3 January, 2013

I have little idea what any of you are saying but I find this thread fascinating. Will be interested to see what comes of it!

dborn @nsw.au |
3 January, 2013

I too have no idea of what you are talking about, but can other devices such as remote cameras be connected via Bluetooth? Could be a solution to tight parking in your garage for instance. Or even for front mounting for park assist.

jat |
3 January, 2013

They drivetrain computers are separate -- you can reboot both of the display computers while you are driving and not notice other than blank screens.

jd3tm |
3 January, 2013

i have been told that there are 2 Main CPU's in the MS.. An Nvidia Tegra 2 for the driver's screen and functions and an Nvidia Tegra 3 for the Main screen and functions. If that's the case, we are talking about a number of ARM processors with separate 2D/3D Graphics controllers, etc. available depending on how they are hooked up and what's enabled via SW.

Depending on how things are jumpered, you may not be able to boot from USB w/o some sort of physical jumper installed, etc.

I would strongly suggest waiting for the App SDK that's been promised rather than tinkering!

Press ctrl-alt-del and then continue to press the Del key while booting... Maybe you get to the BIOS (wishful thinking) lol

tcunning |
3 January, 2013

As anyone looked at what javascript functions are available through the browser? I should be getting my car soon, and I was wondering what was exposed through JavaScript. One might be able to make some cool WebApps if they have exposed car specific info through the browser without having to root it.

Sounds like there's going to be a lot of app overlap. I suspect TM will "filter" them so as not to present users with a zoo of near-equivalents.

Volker.Berlin |
4 January, 2013

Brian H, I hope not. A "zoo of near-equivalents" is called competition and that has proven to be a good thing in the long term.

fluxemag |
4 January, 2013

This thread is awesome. Also one of the reasons I love the car.

michaelwm |
6 January, 2013

If your ctrl-alt-F1 is getting you another TTY, even if you don't see a console you might still be able to type commands. You could test that by issuing a command line reboot (my Linux is rusty... is the command "shutdown" or "reboot"?).

mrspaghetti |
6 January, 2013

@Sargun

You really need to be careful. If you do screw something up it will probably not be covered by warranty. Personally I wouldn't do what you're doing, curious though I am.

aa012a |
7 January, 2013

@michaelwm

I am not in any way recommending this... I'm only expanding on michaelwm's post.

reboot
-or
shutdown 0 -r
-or
init 0
(I would not dare to do the last one, I don't know what state it will render if it executes)

nickjhowe |
7 January, 2013

If you open the drivers door, the plastic panel at the end of the dash parallel with the door roughly level with the door mirror may or may not (ahem) contain an ethernet port...

martin.p |
20 April, 2013

No Ethernet port in there for me: just a round 4-pin connector... (3/2013 production).

Alex K |
21 April, 2013

@martin.p | APRIL 20, 2013: No Ethernet port in there for me: just a round 4-pin connector... (3/2013 production).

Same here just a "round 4-pin" connector. Having been in the networking field for over 35 years, I had never run into a round ethernet connector. But there is an industrial ethernet connector called an M12. See http://m12connector.com

martin.p |
21 April, 2013

Interesting. Has anyone tried connecting to it?

scaesare |
21 April, 2013

I know one other piece of gear (the RED Epic camera) that uses a "ruggedized" industrial connector for Ethernet. It's a 9-pin Lemo style connector, however.

It's plausible that port is indeed Ethernet.

-sc

TeslaTap.com |
22 April, 2013

The 4-pin connector has a cable that looks to be shielded, so I was thinking it's actually an antenna connection - perhaps for XM radio? I don't have sound studio, so it would make sense on my car that its not connected to anything.

Does anyone have the Sound Studio package (i.e. XM radio) and see this white connector not connected and/or connected?

Alex K |
22 April, 2013

@TeslaTap.com | APRIL 22, 2013: Does anyone have the Sound Studio package (i.e. XM radio) and see this white connector not connected and/or connected?

Yes, I have XM and the 4-pin connector is not connected to anything. They do make M12 to RJ45 cables if you're brave enough.

nickjhowe |
11 May, 2013

My bad. I put 2 and 2 together and came up with 5. Not ethernet. No idea whether it is a serial bus or something.

nickjhowe |
11 May, 2013

At least I ASSUME it is not ethernet. Ah heck. I'm completely guessing here.

rswerts |
11 May, 2013

Had a Tesla service tech remove and reinstall the main ECU(17" screen, for a GPS problem) and he used the 4 pin round connector with his laptop to save and restore the main ECU memory. He had an adapter to ethernet to connect to his computer; it looked like the M12. I think I remember seeing Ubuntu on his screen. Very interesting thread.

Tilo |
26 June, 2013

no joy so far with USB keyboards - but pointing devices seem to work

somebody said they got a shell? how?

4-pin connector probably RS232

GeekEV |
26 June, 2013

A round connector is a common industrial ethernet connector. Could it have been an M12?

Anyone know how to remove the check airbag warning after airbag has been replaced

hcwhy |
16 August, 2014

In New Zealand, and I believe Australia, rooting has a different meaning.....it's something most of us love to do...and love to talk about...but not in most public forums or places. Anyway, now that those countries are coming into the Tesla the OP might want to think about changing the name of the thread....then again maybe he/she might not